Two New Supermicro BMC Bugs Allow Malicious Firmware to Evade Root of Trust Security

Cybersecurity researchers released details of two medium-severity vulnerabilities in Supermicro Baseboard Management Controller (BMC) firmware, CVE-2025-7937 and CVE-2025-6198, which could let attackers bypass firmware verification and update the system with a crafted image. Both flaws arise from improper verification of a cryptographic signature, with CVSS scores of 6.6 and 6.4 respectively, according to the article.

Binarly, credited with discovery, says CVE-2025-7937 bypasses the Root of Trust 1.0 verification by redirecting to a fake "fwmap" table, while CVE-2025-6198 bypasses the Signing Table to access a fake "sig_table" in the unsigned region. The article explains the image validation happens in three steps during a firmware update: retrieving the public key, processing the uploaded image’s fwmap or sig_table, and computing a digest to verify against the signature.

It also notes CVE-2024-10237 is related and was disclosed by Supermicro in January 2025, with CVE-2024-10238 and CVE-2024-10239 described as stack overflow flaws in the verification function.